L.S. 546.01 Regolamenti dwar l-Istrutturi ta’ Organizzazzjoni għat-Tqassim u l-Użu mill-Ġdid ta’ Data

(1)The title of these regulations is the Organisational Structures for Data Sharing and Re-Use Regulations.

(2)Citation and scope. Amended by: L.N. 20 of 2025. These regulations provide for: (

1. a)the establishment of a regulatory authority for the purposes of the Re-use of Public Sector Information Act;   Cap. 546. (
2. b)the establishment of an implementation authority for the purposes of the Re-use of Public Sector Information Act;   Cap. 546. (
3. c)the establishment, maintenance and publication of a Register of Registers published on the national data portal; (
4. d)the publication of a Data Classification Scheme to be applied by the data owners to official registers and published as part of the Register of Registers; (
5. e)the legal basis for a standard format and structure for a Uniform Resource Identifier to be used for the identification of official records and for a standard metadata record; (
6. f)the legal basis for a set of Administrative and Data Governance Registers; (
7. g)Council; and the establishment of a Data Governance (
8. h)the implementation of regulatory measures emanating from Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and the re-use of public sector information (recast) and any related Directives and Regulations. 2. requires: In these regulations, unless the context otherwise "Act" means the Re-Use of Public Sector Information Act; Interpretation. Amended by: L.N. 20 of 2025. Cap. 546. 2 [ S.L. 546.01 ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE "Administrative Register" means an official register which is designed to hold records of an administrative nature mainly dealing with the organisational structures of the public administration; "application program interface" or "API" is a set of automated functions and protocols that enable machine-to-machine communications for the exchange and consumption of data in a dynamic environment. Such APIs shall follow a registration process prior to be authorised and included in the national data portal; "controller" has the same meaning as in Article 4 of the General Data Protection Regulation; "Council" or "the Council" or "the Data Governance Council" mean the Data Governance Council as established by Part XI; "data discovery service" means the aggregation of metadata from various sources within the public administration into a single centralised repository to enable a comprehensive web-based search for official registers and datasets including also the pertinent legal basis and the data owner of each official register; it includes also the visualisation of the information provided from such searches; "data owner" means the person or entity responsible for the processing, security, quality and access permissions of an official register; when identifiable information relating to a person is processed, the obligations of a data controller in terms of the General Data Protection Regulation shall apply; "dataset" means an aggregation or filtering of selected data elements from one or more official registers into an identified and persistent list of records which can be used by other automated information services; "Data Classification Scheme" means the Data Classification Scheme as established in Part VI; "Data Governance Register" means an official register published on the national data portal which is intended to maintain records holding information relating to the technical and other details describing information assets and the automated systems used by the public administration; "General Data Protection Regulation" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE [ S.L. 546.01 "information system" means a defined set of automated processes and user interfaces designed to collect, store and disseminate data for the purpose of providing useful information; "national data portal" or "Malta Data Portal" or "national open data portal" means the web-based system and data repository which shall enable the management and publishing directly by the data owners of the data sharing permissions and the controlled lists and vocabularies as reference data, including also the functionality for the discovery of all official registers and the consumption of open data; "official record" means an identifiable and distinct entry in an official register having the necessary qualities to be admissible as evidence in a court of law; "official register" means a collection of official records mandated by Maltese legislation, which is included in the Register of Registers; "open data" means and refers to a concept that is generally understood to denote data in an open format that can be freely used, re-used and shared by anyone for any purpose; "open data policies" means policies which encourage the wide availability and re-use of public sector information for private or commercial purposes, with minimal or no legal, technical or financial constraints; "personal data" has the same meaning as in Article 4 of the General Data Protection Regulation; "public employee" shall have the same meaning as that provided in article 2

(1)of the Public Administration Act; "public sector body" shall have the same meaning as assigned to it by article 2 of the Act; "reference data" means the lists of controlled vocabularies and descriptions which are managed by the data owner of the specific official register in order to provide additional meaning and classification information to the records held in such registers; "Register of Registers" shall mean the Register of Registers established by Part V; "uniform resource identifier" or "URI" is a web-compliant format for the allocation of a machine-readable persistent identifier for every entry in an official register, including the different identifiers assigned to the different versions of each record; and "user" mean public employees and, or data subjects having   Cap. 595. 3 4 [ S.L. 546.01 ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE access to an official register. Part II - Sharing of Data between Public Sector Bodies Sharing of data between public sector bodies. 3. The sharing of data between public sector bodies shall be allowed by the Regulator for the following reasons: (

1. a)to facilitate the re-use and exchange of information between public entities in order to eliminate, wherever possible, the need for an undertaking to provide the same information to more than one public sector body; (
2. b)to assist in the carrying out of a function of one or more of the public sector bodies concerned by (
3. i)reducing the duplication of tasks carried out by one or more public sector bodies; (
4. ii)increasing the efficiency of a public sector body in carrying out that function; (iii) facilitating an improvement in the quality of services being delivered; and, or (
5. iv)reducing service delivery time-frames to clients; (
6. c)to assist a public sector body in verifying the identity of an undertaking being regulated or receiving a service being delivered by the public entity; (
7. d)to assist in the identification or correction of any erroneous information held by one or more of the public entities concerned; (
8. e)to facilitate an analysis of the structure, functions, resources and service delivery methods of a public entity; and (
9. f)to assist in the drafting of strategies and the proposal of policies to Government or to implement Government policies and strategies. Part III - Establishment, Functions and Conduct of Affairs of the Authority Regulatory authority. 4. In the exercise of his functions under article 25(
10. b)of the Act, the Minister is hereby appointing the Information and Data Protection Commissioner as the regulatory authority which shall be responsible for the monitoring of the implementation of the provisions of the Act. ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE [ S.L. 546.01 5 5. In the exercise of its functions under these regulations, the regulatory authority shall act independently and shall not be subject to the direction or control of any other person or authority. Independence of functions. 6. It shall be the duty of the regulatory authority to promote the observance of the requirements of these regulations. General functions of the regulatory authority. 7. The regulatory authority shall receive reports and claims from any person or associations representing them on violations of these regulations, to take such remedial action as it may deem necessary or as may be prescribed under the Act, and to inform such person or associations of the outcome of its decision. Functions of the regulatory authority. 8.

(1)In the exercise of the investigative powers the regulatory authority may request the assistance of the Executive Police in order to enter and search any premises. Regulatory authority’s right of access to information.

(2)The regulatory authority shall be entitled to obtain on request access to any system, metadata and any documentation or copy thereof required in the course of exercising its duties.

(3)Without prejudice to any other provision of any other law, any person who does not comply with any lawful request relevant to an investigation by the regulatory authority shall be guilty of an offence against this regulation. 9.

(1)Any applicant may apply to the regulatory authority for a decision with regard to any request specified hereunder where: (

1. a)a request for information made by the applicant to a public sector body has been refused or has not been dealt with in accordance with the requirements of the Act; or (
2. b)a public sector body is not in compliance with the requirements set out in these regulations.

(2)On receiving an application for a decision under this regulation, the regulatory authority shall take a decision unless it appears to it (

1. a)that the applicant has not exhausted any complaints procedure which may be provided by the public sector body; (
2. b)application; that there has been undue delay in making the (
3. c)that the application is frivolous or vexatious; or (
4. d)abandoned. that the application has been withdrawn or Application for decision by regulatory authority. 6 [ S.L. 546.01 ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE

(3)Where the regulatory authority has received an application under this regulation, it shall either (

1. a)notify the applicant that it has not taken any decision under this regulation as a result of the application and of its grounds for not doing so; or (
2. b)serve notice of its decision on the applicant and on the public sector body.

(4)appeal. A decision notice shall contain particulars of the right of

(5)Where a decision notice requires steps to be taken by the public sector body within a specified period, the time specified in the notice shall not expire before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, no step which is affected by the appeal need be taken pending the determination or withdrawal of the appeal. Information notices. 10.

(1)If the regulatory authority has received an application for a decision or reasonably requires any information for the purpose of determining whether a public sector body has complied or is complying with any of the requirements of these regulations, it may serve the public sector body with an information notice requiring it, within such time as is specified in the notice, to furnish the regulatory authority, in such a manner as may be so specified, with such information as is so specified relating to the application.

(2)An information notice shall specify the purpose for which the regulatory authority requires the information and, where it refers to information recorded in a document, shall include such details as are reasonably necessary to enable a responsible officer of the public sector body to identify that document.

(3)A public sector body shall not be required by virtue of this regulation to make available to the regulatory authority any information in respect of: (

1. a)any communication between a professional legal adviser and his client in connection with the giving of legal advice to the client with respect to his obligations, liabilities or rights under this regulation; or (
2. b)any communication between a professional legal adviser and his client, or between such an adviser or his client and any other person, made in connection with or in contemplation of proceedings under or arising out of this regulation (including proceedings before the Tribunal) and for the purposes of such proceedings. ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE [ S.L. 546.01 7

(4)In sub-regulation

(3)references to the client of a professional legal adviser include references to any person representing such a client.

(5)The regulatory authority may cancel an information notice by written notice to the public sector body on which it was served. 11.

(1)If the regulatory authority is satisfied that a public sector body has failed to comply with any of its obligations under these regulations, the Commissioner may serve the authority with an enforcement notice requiring the authority to take, within such a time as may be specified in the notice, such steps as may be so specified for complying with those obligations. Enforcement notices.

(2)An enforcement notice shall contain a statement of the requirement or requirements of these regulations with which the public sector body has, in the regulatory authority’s opinion, failed to comply, and its reasons for reaching that conclusion.

(3)The regulatory authority may cancel an enforcement notice by written notice to the public sector body on which it was served. 12. Where a public sector body or an officer of such public sector body refuses or, without a good reason, fails to comply with (

1. a)to be taken; Failure to comply with notice. so much of a decision notice as requires steps (
2. b)an information notice; or (
3. c)an enforcement notice, the regulatory authority may levy an administrative fine against the defaulting public sector body or officer thereof. 13.

(1)Where the regulatory authority imposes an administrative fine, it shall by order in writing require the public sector body to pay such administrative fine, which shall be due to the regulatory authority as a civil debt: Administrative fines. Amended by: L.N. 20 of 2025. Provided that such order shall be subject to the appeal procedure.

(2)In the absence of an appeal, the decision of the regulatory authority shall become final and shall constitute an executive title for the purposes of Title VII of the Code of Organization and Civil Procedure as if the decision had been ordered by a judgement of a court of civil jurisdiction.

(3)Where a notice imposing an administrative fine is served     Cap. 12. 8 [ S.L. 546.01 ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE on a public sector body and (

1. a)such public sector body fails to appeal within such time as an appeal may be entered and fails to pay the fine so imposed; or (
2. b)such public sector body appeals within such time to the Administrative Review Tribunal and the appeal is withdrawn or the Tribunal confirms the fine in the amount fixed by the Commissioner or in an amount reduced by it and no further appeal is filed with the Court of Appeal, or if an appeal is filed with the Court of Appeal and such Court either confirms the decision taken or decides that a penalty is due in another amount, or the imposed penalty is not paid within fifteen days from the date of the decision or the withdrawal of the appeal, or the date when the Tribunal or the Court of Appeal confirms or varies the penalty as aforesaid, the regulatory authority shall be entitled to take civil action to recover the amount due.

(4)Such a fine shall not be less than two thousand five hundred euro (€2,500) and shall not exceed ten thousand euro (€10,000) for each violation, and or a daily fine not less than twentyfive euro (€25) and not more than fifty euro (€50).

(5)Without prejudice to the preceding provisions of this regulation, the regulatory authority may, after giving due regard to the circumstances of the case, impose an administrative fine on any public sector body that (

1. a)knowingly provides false information to the regulatory authority when so requested by the regulatory authority pursuant to its investigative powers; or (
2. b)does not comply with any lawful request pursuant to an investigation by the regulatory authority: Provided that such a fine shall not be less than two thousand five hundred euro (€2,500) and shall not exceed ten thousand euro (€10,000) for each violation. Methods of service. 14.

(1)Where the regulatory authority exercises its powers pursuant to these regulations, its decision shall forthwith be served on the public sector body and the person to whom the decision is addressed, which decision shall be served either personally, by registered post to the person’s last known business or private address, or by electronic means that provide a reliable record of when service took place.

(2)In the case of service by electronic means, the decision ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE [ S.L. 546.01 9 shall be deemed to have been served upon each person to whom the decision is addressed when the regulatory authority has received: (

1. a)an electronic receipt automatically generated by the e-mail server when the communication is read; (
2. b)a written confirmation by return electronic mail from the person to whom the decision is addressed; or (
3. c)a verbal confirmation from the person to whom the decision is addressed that the electronic mail was received.

(3)If service is not effected within a week of issuing the decision, because the person to whom the decision refers could not be found or for any other reason attributable to the person to whom the decision is addressed, the regulatory authority shall publish a notice in the Gazette and in one or more daily newspapers, stating that a decision has been taken in respect of the person to whom the decision is addressed and inviting him to collect the decision from the regulatory authority’s office. In any such case, service shall be deemed to have been effected on the third day after the date of publication of the last notice. 15.

(1)Where a decision notice has been served, the applicant or the public sector body may appeal to the Tribunal against the notice within twenty working days. Appeals against notices served by the regulatory authority.

(2)If, on an appeal under this regulation, the Tribunal considers that (

1. a)the notice against which the appeal is brought is not in accordance with the law; or (
2. b)to the extent that the notice involved an exercise of discretion by the regulatory authority, it ought to have exercised its discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the regulatory authority; and in any other case the Tribunal shall dismiss the appeal.

(3)Where the Tribunal substitutes a notice as aforesaid, the regulatory authority shall take action to secure compliance as if that notice had been issued by the regulatory authority. Part IV - Implementation of the Act 16.

(1)In the exercise of his functions under article 25(c) of the Act, the Minister is hereby appointing the the Data Governance Council as the implementing entity which shall be responsible for the implementation of the provisions of the Act. Appointment and functions of the implementing entity. Amended by: L.N. 20 of 2025. 10 [ S.L. 546.01 ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE

(2)In the exercise of its functions, the implementing entity shall be responsible for the implementation of the objectives of the Act and, without prejudice to the generality of the foregoing, the implementing entity shall (

1. a)serve as the main co-ordinator and first line of call for any of the obligations arising from the Act: Provided that the implementing entity shall, at all times, seek the instructions of, and execute any directions received from, the data owner when observing its responsibilities listed in this sub-regulation; (
2. b)publish a standard and format for the management of communications between the public administration and natural persons and, or organisations; and (
3. c)establish the national data portal through which the data discovery and data consumption services, as may be applicable and authorised by the data owner, shall be provided.

(3)The implementing entity shall provide the information system platform for the Register of Registers as well as the Administrative Registers and shall supervise and co-ordinate with the data owners to ensure that the classification and other metadata as provided for in these regulations are being maintained by the relevant data owner.

(4)Any refused request for data or disagreement in regard to the classifications or other decisions taken by the data owner, and arising from within the public administration, shall in the first instance be dealt with through an escalation procedure which refers the relevant facts for the consideration of the Data Governance Council as established and regulated by Part XI.

(5)Any other dispute concerning a refused request for data or any challenge in regard to the details as published on the national data portal shall follow the process as established in regulation

1. Responsibilities of the data owner
2. In order to ensure adherence, by the implementing entity, of its responsibilities set out in regulation 16

(2), data owners shall be responsible to: (

1. a)directly maintain and ensure that the classification and other metadata as published on the national data portal reflects the true information in respect of the specific register or registers which fall within their legal responsibilities; and (
2. b)provide to the implementing entity the required software products and tools that shall be used to enable the ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE [ S.L. 546.01 11 ‘machine to machine’ communication of contents that may be allowed to be shared or re-used on the basis of the classifications assigned and published by the data owner on the national data portal; (
3. c)data owners shall be obliged to maintain and publish on the national data portal a list of datasets and their respective API’s. Each dataset thus published should also be linked to an official register as previously included in the Register of Registers; and (
4. d)data owners shall be obliged to maintain on the national data portal the relevant data governance details which may be authorised by the Data Governance Council so that the relevant data flows and data dependencies can be effectively managed at the national level. Part V - Register of Registers 18.

(1)The implementing entity shall publish a list of official registers for the data catalogue of the national open data portal known as the Register of Registers, which shall include therein: (

1. a)the name of the official register; (
2. b)the law applicable to the official register; Register of Registers. Amended by: L.N. 20 of 2025. (
3. c)the public sector body or function responsible for the official register; (
4. d)the relevant classification indicators as applicable and according to the the Data Classification Scheme as published on the national data portal; and (
5. e)the uniform resource identifier (‘URI’) to serve as the persistent internal identifier of an official register.

(2)The implementing entity shall ensure transparency in its processes relating to the Register of Registers by adhering to the rules as applicable to any official register and as indicated in these regulations. Part VI - Data Classification Scheme 19.

(1)The implementing entity shall co-ordinate with the identified data owner of each register so that such data owner shall use the values and criteria as published on the national data portal in order to add the applicable classification indicators to the information maintained pertinent to the register. Such information shall also be made available as part of the Open Data publications Data Classification Scheme. Amended by: L.N. 20 of 2025. 12 [ S.L. 546.01 ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE from the national data portal. Part VII - Uniform Resource Identifier URI structure and format. 20.

(1)The implementing entity shall publish a standard and format for the management of a persistent identifier to be applied to all official records.

(2)The Uniform Resource Identifier shall be composed of three main parts, namely the indication that this is a record which has its legal authority from the Laws of Malta, a second part which identifies the official register and the third part which shall identify the individual record or a particular version of the same record according to the record version control mechanism described in regulation 21. Record Version Control mechanism. 21.

(1)The implementing entity shall publish a standard and format for the management of a record version control mechanism.

(2)Every official record shall provide the facility to identify the different versions resulting either from the original insertion into the register and for any other change of any one of the elements that constitute such a record from the business perspective.

(3)Each record version shall have its own unique Uniform Resource Identifier which will enable the identification of all changes to a specific record with time stamps indicating the start and the end of such a record version.

(4)The obligation to achieve this version control mechanism rests with the respective data owners and is applicable for information systems introduced after the coming into force of these regulations. Part VIII – Metadata Standards Record label. 22.

(1)The implementing entity shall publish a standard and format for the management of a metadata record, also referred to as the record label, to be applied to all official records.

(2)The owner of an official register shall be obliged to follow such standards which are aimed at enabling interoperability of records and information required for an audit of such records and for the provenance and the process from which records originate in view of the retention periods that may be applicable on the basis of such information. Part IX - Reference Data Management Reference data vocabulary. 23.

(1)The implementing entity shall provide a repository and the necessary maintenance, discovery and publishing ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE [ S.L. 546.01 13 facilities for the reference data as applicable to all official registers included in the Register of Registers.

(2)The owner of an official register shall be obliged to use such facilities to maintain and publish the reference data pertinent to the specific register. Part X - Administrative Registers 24.

(1)The implementing entity shall provide a repository and the necessary maintenance, discovery and publishing facilities for the administrative data as applicable to all official registers included in the Register of Registers and which are classified as administrative or data governance registers.

(2)Such registers shall follow the normal rules as applicable to other official registers.

(3)Public administration systems and processes shall be obliged to use the official records from the administrative registers when such records are published and accessible through API’s from the national data portal or other authorised portals as applicable. Such data can be copied and stored as part of the local data repositories for continuity and operational reasons provided it is not updated or in any way maintained or changed at the line-of-business level. Part XI - Data Governance Council 25.

(1)There shall be established a Data Governance Council, hereinafter referred to as "the Council", which shall have the functions referred to in the following provisions of this regulation.

(2)The Council shall serve as the focal point for coordination and mediation, as may be required, in relation to the management of official registers and official records within the public administration functions as well as the focal point for any other data-related matters as directed by the Minister responsible for public sector information.

(3)The Council shall be the main consultative and advisory body in respect of all matters relating to the governance of official registers and high-level discussions, mediation and the formulation of policy, direction and decisions relating to corporate and enterprise (horizontally applicable) data within the public administration.

(4)The Council shall be involved in the discussions between data owners and any third party requesting access to specific registers or datasets before such requests are submitted for the consideration of the regulatory authority. The proposals or decisions of the Council shall be without prejudice to, and subject to, decisions of the regulatory authority. Data Governance Council. Amended by: L.N. 20 of 2025. 14 [ S.L. 546.01 ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE

(5)The Council shall be composed of a chairperson and members having the required credentials and academic background necessary for an informed discussion on the subject of data management in the context of the public administration processes and requirements as appointed for a term of three

(3)years by the Principal Permanent Secretary.

(6)The core members of the Council shall be selected from the main functions of the public administration which have the most impact on the implementation of the information systems and the related national strategies as may be applicable at the time. The number of core members forming part of the Council shall not exceed ten

(10)persons.

(6a)Council. The chairperson may appoint a secretary to serve the

(7)The Council may also invite and involve other experts and subject-matter specialists as may be required from time to time and according to the issues and subjects then being dealt with at the time.

(8)The Council shall, after due consideration and appraisal of the information supplied, refer the disputed requests received, conclusions and proposals agreed within the Council to the Principal Permanent Secretary for authorisation or any other direction as may be applicable. First Schedule Data Classification Scheme Deleted by Legal Notice 20 of

1. Second Schedule Register of Registers Deleted by Legal Notice 20 of
2. ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE Third Schedule Metadata record structure Deleted by Legal Notice 20 of
3. Fourth Schedule Administrative Registers Deleted by Legal Notice 20 of
4. Fifth Schedule Data Governance Registers Deleted by Legal Notice 20 of
5. [ S.L. 546.01 15